For some industries it's imperative, sure, but a POS gas pump? Video game crashing? No one's gonna complain too hard, they'll just go somewhere else.
Vulnerabilities are built on this kind of laziness though, you're right. But the same rule applies to attackers. Why spend all your energy on a vuln that's only open 24 hours every four years? Target, timing, capacity for things to change in four years etc makes it unreasonable.